p PatchFirst

CVE-2026-50558

CVE-2026-50558 · Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.

CVSS 5.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • penelope

    Versions
    • < 0.20.0: Affected

    No fix published

  • penelope-shell-handler PyPI

    Versions
    • 0.15.0
    • 0.18.0
    • 0.19.1
    Affected ranges
    • ECOSYSTEM: < 0.20.0

    Update to 0.20.0

Original sources

Check your server →